[ruby-core:121835] [Ruby Bug#21310] YJIT optimization causes incorrect is_a? method evaluation

[ruby-core:121835] [Ruby Bug#21310] YJIT optimization causes incorrect is_a? method evaluation

[ravron-hb (Riley Avron) via ruby-core]

Issue #21310 has been reported by ravron-hb (Riley Avron).

----------------------------------------
Bug #21310: YJIT optimization causes incorrect is_a? method evaluation
https://bugs.ruby-lang.org/issues/21310

* Author: ravron-hb (Riley Avron)
* Status: Open
* ruby -v: ruby 3.4.1 (2024-12-25 revision 48d4efcb85) +YJIT +PRISM [arm64-darwin24]
* Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN
----------------------------------------
Our Rails application contains code like the following:

```ruby
result = a_proc.call

if result.is_a?(Result) && result.nil?
  puts('This should be impossible')
end
```

With YJIT enabled in dev mode and the `yjit-call-threshold` set to 2, the seemingly impossible condition always evaluates to true, and the `puts` is evaluated. If YJIT is disabled, the code behaves as expected: namely, the condition never evaluates to true. If YJIT is enabled but not in dev mode, with the `yjit-call-threshold` is set to 1,500 (as in our original configuration), the error occurs non-deterministically.

We originally discovered this issue while updating to Rails 7.2. The following code began to occasionally fail with a `NoMethodError`, complaining that `nil:NilClass` does not define `success?`:

```ruby
result = a_proc.call

raise ResultRollbackError, result if result.is_a?(Result) && !result.success?
```

`Result` *does* define `success?`, so it seemed impossible that `result.success?` would be invoked unless `result.is_a?(Result)`, and especially impossible that it would be invoked if `result.nil?`. After various debugging, we added the `if` statement shown in the first code block and discovered that YJIT’s optimizations seem to be incorrect.

The inability to predict the possible errors this could cause in our application led us to disable YJIT for our entire application while this behavior persists.

Unfortunately, we have not been able to reproduce the error in a self-contained case, which I know will make investigation more difficult. That said, we would like to assist in solving it however possible. We would appreciate guidance on how to obtain relevant debugging information, or suggestions on how we might generate a self-contained reproduction of the issue. We would also be willing to consider allowing a Ruby maintainer to review the actual code demonstrating the issue, though we would probably request that they sign an NDA in that case.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/

[ruby-core:121867] [Ruby Bug#21310] YJIT optimization causes incorrect is_a? method evaluation

[k0kubun (Takashi Kokubun) via ruby-core]

Issue #21310 has been updated by k0kubun (Takashi Kokubun).

Assignee set to jit

----------------------------------------
Bug #21310: YJIT optimization causes incorrect is_a? method evaluation
https://bugs.ruby-lang.org/issues/21310#change-112930

* Author: ravron-hb (Riley Avron)
* Status: Open
* Assignee: jit
* ruby -v: ruby 3.4.1 (2024-12-25 revision 48d4efcb85) +YJIT +PRISM [arm64-darwin24]
* Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN
----------------------------------------
Our Rails application contains code like the following:

```ruby
result = a_proc.call

if result.is_a?(Result) && result.nil?
  puts('This should be impossible')
end
```

With YJIT enabled in dev mode and the `yjit-call-threshold` set to 2, the seemingly impossible condition always evaluates to true, and the `puts` is evaluated. If YJIT is disabled, the code behaves as expected: namely, the condition never evaluates to true. If YJIT is enabled but not in dev mode, with the `yjit-call-threshold` is set to 1,500 (as in our original configuration), the error occurs non-deterministically.

We originally discovered this issue while updating to Rails 7.2. The following code began to occasionally fail with a `NoMethodError`, complaining that `nil:NilClass` does not define `success?`:

```ruby
result = a_proc.call

raise ResultRollbackError, result if result.is_a?(Result) && !result.success?
```

`Result` *does* define `success?`, so it seemed impossible that `result.success?` would be invoked unless `result.is_a?(Result)`, and especially impossible that it would be invoked if `result.nil?`. After various debugging, we added the `if` statement shown in the first code block and discovered that YJIT’s optimizations seem to be incorrect.

The inability to predict the possible errors this could cause in our application led us to disable YJIT for our entire application while this behavior persists.

Unfortunately, we have not been able to reproduce the error in a self-contained case, which I know will make investigation more difficult. That said, we would like to assist in solving it however possible. We would appreciate guidance on how to obtain relevant debugging information, or suggestions on how we might generate a self-contained reproduction of the issue. We would also be willing to consider allowing a Ruby maintainer to review the actual code demonstrating the issue, though we would probably request that they sign an NDA in that case.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/

[ruby-core:121868] [Ruby Bug#21310] YJIT optimization causes incorrect is_a? method evaluation

[k0kubun (Takashi Kokubun) via ruby-core]

Issue #21310 has been updated by k0kubun (Takashi Kokubun).

Status changed from Open to Feedback

I think it's most likely fixed by https://github.com/ruby/ruby/pull/13245. It's going to be shipped in the next release. I'm thinking of releasing it as soon as we address a few other similar cases.

----------------------------------------
Bug #21310: YJIT optimization causes incorrect is_a? method evaluation
https://bugs.ruby-lang.org/issues/21310#change-112931

* Author: ravron-hb (Riley Avron)
* Status: Feedback
* Assignee: jit
* ruby -v: ruby 3.4.1 (2024-12-25 revision 48d4efcb85) +YJIT +PRISM [arm64-darwin24]
* Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN
----------------------------------------
Our Rails application contains code like the following:

```ruby
result = a_proc.call

if result.is_a?(Result) && result.nil?
  puts('This should be impossible')
end
```

With YJIT enabled in dev mode and the `yjit-call-threshold` set to 2, the seemingly impossible condition always evaluates to true, and the `puts` is evaluated. If YJIT is disabled, the code behaves as expected: namely, the condition never evaluates to true. If YJIT is enabled but not in dev mode, with the `yjit-call-threshold` is set to 1,500 (as in our original configuration), the error occurs non-deterministically.

We originally discovered this issue while updating to Rails 7.2. The following code began to occasionally fail with a `NoMethodError`, complaining that `nil:NilClass` does not define `success?`:

```ruby
result = a_proc.call

raise ResultRollbackError, result if result.is_a?(Result) && !result.success?
```

`Result` *does* define `success?`, so it seemed impossible that `result.success?` would be invoked unless `result.is_a?(Result)`, and especially impossible that it would be invoked if `result.nil?`. After various debugging, we added the `if` statement shown in the first code block and discovered that YJIT’s optimizations seem to be incorrect.

The inability to predict the possible errors this could cause in our application led us to disable YJIT for our entire application while this behavior persists.

Unfortunately, we have not been able to reproduce the error in a self-contained case, which I know will make investigation more difficult. That said, we would like to assist in solving it however possible. We would appreciate guidance on how to obtain relevant debugging information, or suggestions on how we might generate a self-contained reproduction of the issue. We would also be willing to consider allowing a Ruby maintainer to review the actual code demonstrating the issue, though we would probably request that they sign an NDA in that case.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/

[ruby-core:122273] [Ruby Bug#21310] YJIT optimization causes incorrect is_a? method evaluation

[nagachika (Tomoyuki Chikanaga) via ruby-core]

Issue #21310 has been updated by nagachika (Tomoyuki Chikanaga).

Backport changed from 3.2: REQUIRED, 3.3: REQUIRED, 3.4: DONE to 3.2: REQUIRED, 3.3: DONE, 3.4: DONE

ruby_3_3 commit:380938998415c22ba3ca9bc01f4035d5a73f274d merged revision(s) commit:cbf9c088f8005a49b6aa3f475c70041357774c61.

----------------------------------------
Bug #21310: YJIT optimization causes incorrect is_a? method evaluation
https://bugs.ruby-lang.org/issues/21310#change-113415

* Author: ravron-hb (Riley Avron)
* Status: Feedback
* Assignee: jit
* ruby -v: ruby 3.4.1 (2024-12-25 revision 48d4efcb85) +YJIT +PRISM [arm64-darwin24]
* Backport: 3.2: REQUIRED, 3.3: DONE, 3.4: DONE
----------------------------------------
Our Rails application contains code like the following:

```ruby
result = a_proc.call

if result.is_a?(Result) && result.nil?
  puts('This should be impossible')
end
```

With YJIT enabled in dev mode and the `yjit-call-threshold` set to 2, the seemingly impossible condition always evaluates to true, and the `puts` is evaluated. If YJIT is disabled, the code behaves as expected: namely, the condition never evaluates to true. If YJIT is enabled but not in dev mode, with the `yjit-call-threshold` is set to 1,500 (as in our original configuration), the error occurs non-deterministically.

We originally discovered this issue while updating to Rails 7.2. The following code began to occasionally fail with a `NoMethodError`, complaining that `nil:NilClass` does not define `success?`:

```ruby
result = a_proc.call

raise ResultRollbackError, result if result.is_a?(Result) && !result.success?
```

`Result` *does* define `success?`, so it seemed impossible that `result.success?` would be invoked unless `result.is_a?(Result)`, and especially impossible that it would be invoked if `result.nil?`. After various debugging, we added the `if` statement shown in the first code block and discovered that YJIT’s optimizations seem to be incorrect.

The inability to predict the possible errors this could cause in our application led us to disable YJIT for our entire application while this behavior persists.

Unfortunately, we have not been able to reproduce the error in a self-contained case, which I know will make investigation more difficult. That said, we would like to assist in solving it however possible. We would appreciate guidance on how to obtain relevant debugging information, or suggestions on how we might generate a self-contained reproduction of the issue. We would also be willing to consider allowing a Ruby maintainer to review the actual code demonstrating the issue, though we would probably request that they sign an NDA in that case.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/

[ruby-core:122276] [Ruby Bug#21310] YJIT optimization causes incorrect is_a? method evaluation

[nagachika (Tomoyuki Chikanaga) via ruby-core]

Issue #21310 has been updated by nagachika (Tomoyuki Chikanaga).


Since jump_to_next_insn() has different arguments and return type on ruby_3_3, some follow up changes for commit:380938998415c22ba3ca9bc01f4035d5a73f274d were pushed.
commit:7230a070e3dffc765fc6617436a2293c459c6c8d
commit:c1c068e43c80aeb2e711b64261323594eca66217

----------------------------------------
Bug #21310: YJIT optimization causes incorrect is_a? method evaluation
https://bugs.ruby-lang.org/issues/21310#change-113417

* Author: ravron-hb (Riley Avron)
* Status: Feedback
* Assignee: jit
* ruby -v: ruby 3.4.1 (2024-12-25 revision 48d4efcb85) +YJIT +PRISM [arm64-darwin24]
* Backport: 3.2: REQUIRED, 3.3: DONE, 3.4: DONE
----------------------------------------
Our Rails application contains code like the following:

```ruby
result = a_proc.call

if result.is_a?(Result) && result.nil?
  puts('This should be impossible')
end
```

With YJIT enabled in dev mode and the `yjit-call-threshold` set to 2, the seemingly impossible condition always evaluates to true, and the `puts` is evaluated. If YJIT is disabled, the code behaves as expected: namely, the condition never evaluates to true. If YJIT is enabled but not in dev mode, with the `yjit-call-threshold` is set to 1,500 (as in our original configuration), the error occurs non-deterministically.

We originally discovered this issue while updating to Rails 7.2. The following code began to occasionally fail with a `NoMethodError`, complaining that `nil:NilClass` does not define `success?`:

```ruby
result = a_proc.call

raise ResultRollbackError, result if result.is_a?(Result) && !result.success?
```

`Result` *does* define `success?`, so it seemed impossible that `result.success?` would be invoked unless `result.is_a?(Result)`, and especially impossible that it would be invoked if `result.nil?`. After various debugging, we added the `if` statement shown in the first code block and discovered that YJIT’s optimizations seem to be incorrect.

The inability to predict the possible errors this could cause in our application led us to disable YJIT for our entire application while this behavior persists.

Unfortunately, we have not been able to reproduce the error in a self-contained case, which I know will make investigation more difficult. That said, we would like to assist in solving it however possible. We would appreciate guidance on how to obtain relevant debugging information, or suggestions on how we might generate a self-contained reproduction of the issue. We would also be willing to consider allowing a Ruby maintainer to review the actual code demonstrating the issue, though we would probably request that they sign an NDA in that case.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/